CyberSentience: Automating Threat Perception using Association Rule Mining

CSC172 Data Mining and Analysis Final Project
Mindanao State University - Iligan Institute of Technology
Student: Jemar John J Lumingkit, 2022-1991 Semester: AY 2025-2026 Sem 1

Abstract

Traditional Network Intrusion Detection Systems (NIDS) often rely on manually defined signatures, a reactive process that struggles to keep pace with evolving cyber threats. This project presents CyberSentience, an automated threat perception system that leverages Association Rule Mining (ARM) to discover hidden patterns in network traffic. Using the benchmark NSL-KDD dataset, we transformed raw connection logs into transactional data through discretization and one-hot encoding. We applied the Apriori Algorithm to extract 1,531 high-quality attack signatures, achieving a confidence level of over 60% for identifying Denial of Service (DoS) and Probe attacks. The system demonstrates that interpretable machine learning can effectively automate the generation of firewall rules, reducing the workload on security analysts.

Table of Contents

• Introduction
• Related Work
• Methodology
• Experiments & Results
• Discussion
• Ethical Considerations
• Conclusion
• Installation
• References

Introduction

Problem Statement

Network security analysts are overwhelmed by the sheer volume of logs generated by modern networks. Manually correlating features (e.g., "service=private" AND "flag=S0") to identify an attack is slow and prone to human error. There is a critical need for systems that can automatically mine historical data to find these correlations and generate predictive rules.

Objectives

• Data Transformation: Convert continuous network features (duration, bytes) into categorical bins suitable for mining.
• Pattern Discovery: Use the Apriori algorithm to uncover frequent itemsets that map specific protocol behaviors to attack labels.
• Rule Evaluation: Optimize the trade-off between rule quantity and quality using Support, Confidence, and Lift metrics.

Figure 1: Co-occurrence heatmap showing correlations between network flags and attack classes.

Related Work

• Dhanalakshmi & Usha (2022): Applied Association Rule Mining with a modified Frequent Pattern Tree (FPT) algorithm to the NSL-KDD dataset. Their work demonstrated that mining frequent itemsets can effectively separate normal traffic from malicious patterns like DoS attacks by generating high-confidence rules.
• Samy et al. (2021): Proposed a framework integrating Apriori-based association rules with classification algorithms for Network Intrusion Detection. They successfully extracted human-readable rules (e.g., service=ecr_i $\rightarrow$ smurf attack) from intrusion datasets, validating the "White Box" capability of ARM compared to opaque deep learning models
• Al-Omari et al. (2022): Conducted a comprehensive study of tree-based and rule-learning approaches on the NSL-KDD dataset. Their research highlighted that while Deep Learning achieves marginally higher accuracy, rule-based methods offer superior interpretability, which is critical for security analysts to trust and verify detection alerts.
• Research Gap: While Deep Learning offers high accuracy, it lacks interpretability ("Black Box"). This project applies ARM to create "White Box" rules that explain why traffic is flagged.

Methodology

Dataset

• Source: NSL-KDD Dataset (KDDTrain+_20Percent.txt)
• Content: ~25,000 Network Connection Records.
• Preprocessing: - Binning: Numerical columns (duration, src_bytes) mapped to bins (Zero, Low, High).
  • Encoding: Categorical features converted to sparse boolean matrix via TransactionEncoder.

Architecture

The pipeline consists of:

1. Ingestion & Cleaning (Pandas)
2. Discretization (Custom Binning Logic)
3. Frequent Itemset Mining (Apriori)
4. Rule Generation (Association Rules)
5. Attack Filter (Extracting Antacedent $\rightarrow$ Attack rules)

Mining Code Snippet

notebooks/03_Mining_Apriori.ipynb excerpt

from mlxtend.frequent_patterns import apriori, association_rules

# Generate Frequent Itemsets
frequent_itemsets = apriori(df_encoded, min_support=0.05, use_colnames=True)

# Generate Rules with 60% Confidence
rules = association_rules(frequent_itemsets, metric="confidence", min_threshold=0.6)

# Filter for Attack Predictions
attack_rules = rules[rules['consequents'].apply(lambda x: 'Attack' in str(x))]

Experiments & Results

To determine the optimal parameters for the detection engine, we conducted a sensitivity analysis by varying the Minimum Support.

Metrics Comparison

Setting Mode	Min Support	Min Confidence	Total Rules	Attack Rules
Loose	0.01 (1%)	0.5 (50%)	16,608	5,355
Balanced	0.05 (5%)	0.6 (60%)	4,515	1,531
Strict	0.10 (10%)	0.7 (70%)	2,406	793

Interpretation

• Loose (0.01): Resulted in rule explosion. While it caught rare attacks, the volume of rules (5,355) is too high for practical manual verification.

• Strict (0.10): Missed too many stealthy attacks. Only massive-volume traffic patterns were detected.

• Selected Model (Balanced): We deployed the 0.05 Support model. It generated 1,531 high-confidence rules, identifying threats like Neptune (DoS) and Satan (Probe) with >95% confidence while filtering out noise.

Figure 2: Support vs. Confidence. The color gradient indicates Lift; rules with lower support often possess the highest Lift, indicating strong causal links.

Demo

Discussion

• Strengths: The system produces human-readable signatures. Unlike a neural network, a security analyst can look at a rule (IF Flag=S0 AND Service=Private THEN Attack=Neptune) and understand exactly what to block at the firewall.

• Limitations: The algorithm relies on historical frequency. It cannot detect Zero-Day attacks (novel threats) that have never appeared in the training logs before.

• Insights: Data discretization was the most critical step. Without binning Source Bytes, the Apriori algorithm failed to find patterns due to the high cardinality of continuous numbers.

Ethical Considerations

• Dual Use: While designed for defense, the generated association rules could theoretically help attackers understand detection thresholds to craft evasion techniques.

• Privacy: The NSL-KDD dataset is anonymized (sanitized IP addresses), ensuring no personal data was exposed during training.

• Bias: The dataset reflects network traffic from 2009. Modern encrypted traffic (HTTPS) patterns may not be fully represented.

Conclusion

CyberSentience successfully demonstrated that Association Rule Mining can automate the creation of Intrusion Detection signatures. By processing 25,000 records, we extracted over 1,500 actionable security rules. Future work involves integrating these rules into a real-time engine like Snort and applying FPGrowth for faster mining on larger datasets.

Installation

Clone repo: git clone https://github.com/KINGSTING/CSC172-AssociationMining-Lumingkit

Install deps: pip install -r requirements.txt

Run Notebooks: Open notebooks/03_Mining_Apriori.ipynb

requirements.txt:

pandas
numpy
matplotlib
seaborn
mlxtend
notebook

References

[1] Dhanalakshmi, B., & Usha, M. (2022). "Association Rule Mining Frequent-Pattern-Based Intrusion Detection in Network." Computer Systems Science and Engineering, 44(2), 1135–1149.

[2] Samy, H. J., El-Aziz, A. A., & El-Rifaie, A. M. (2021). "Enhancing Network Intrusion Detection Model Using Machine Learning Algorithms." Computers, Materials & Continua, 67(1), 979–996.

[3] Al-Omari, M., Rawashdeh, M., Qutaishat, F., & Alshira’h, M. (2022). "A Study of Network Intrusion Detection Systems Using Artificial Intelligence/Machine Learning." Applied Sciences, 12(22), 11752.

GitHub Pages

View this project site: https://kingsting.github.io/CSC172-AssociationMining-Lumingkit/